Every hiring decision feels like a high‑stakes gamble. You want to hire talent that fits culture, can hit targets, and won’t bring hidden risks. That’s why the question “what can recruiters check about candidates” pops up daily in HR inboxes. Understanding the line between lawful insight and privacy invasion protects your brand and keeps lawsuits at bay.
And when you get the balance right, you’ll see faster hires, lower turnover, and smoother onboarding. So let’s break down the rules that shape what you’re allowed to dig into.
General Overview of Pre‑Employment Screening
Pre‑employment screening limits vary from federal statutes to state‑specific bans. In most cases, you start with consent, then pull data from sources that are publicly available or covered by law. The process usually rolls out in three phases: verification, reference, and investigative checks.
Employment Verification Process
Verifying a candidate’s job history is the backbone of any background check. You can call former employers, request W‑2s, or use third‑party verification services. Just remember that the Fair Credit Reporting Act (FCRA) demands a clear disclosure and a copy of the report if you decide to take action based on it.
But you can’t ask for salary history in many states without risking discrimination claims. A quick glance at the local ban‑the‑box law will tell you if salary data is off‑limits.
Reference Checks Best Practices
Reference calls are a conversation, not a subpoena. Ask about performance, attendance, and teamwork—avoid probing into health, family, or protected characteristics. Document the call, note the date, and keep the notes for no more than 12 months.
Now, a savvy recruiter will ask the candidate which references are safe to contact, then get written permission before dialing. That extra step safeguards candidate privacy rights and keeps you on the right side of recruiter background check rules.
Legal Landscape of What Recruiters Can Check
The legal field is a patchwork of federal mandates and state quirks. Below you’ll find the major data categories and the dos and don’ts that shape how you can act.
Criminal History and Ban the Box
Federal law lets you run a criminal background check after a conditional offer. Understanding criminal history inquiry post-offer timing is equally important, since many state and local fair-chance laws impose additional restrictions on when employers can begin reviewing criminal records. However, the “ban‑the‑box” movement forces many states to hide conviction questions until later in the hiring process. California, New York, and Illinois, for example, require you to wait until after an interview before you ask about arrests.
And if you operate in a state with strict ban‑the‑box provisions, asking too early can lead to a $2,000 penalty per violation. A real‑world case in Texas showed a retailer fined $5,000 after a candidate sued for premature criminal questioning.
Credit Reports and the FCRA
Credit checks are only permissible when the role involves significant financial responsibility—think CFOs, loan officers, or senior accountants. The FCRA says you must provide a pre‑clearance disclosure and a copy of the report if you reject the candidate based on credit. Following a structured FCRA adverse action workflow helps employers meet notification requirements, provide candidates with an opportunity to dispute inaccuracies, and reduce compliance risks.
State laws add another layer. Michigan, for instance, bans credit checks for most positions except for government‑related financial duties. Ignoring these nuances can cost your company up to $1,000 per illegal check.
Social Media and Public Profiles
Scanning publicly available LinkedIn, GitHub, or Twitter posts is generally allowed. Recruiters should also understand the legal limits on online candidate research, particularly when reviewing publicly available information that could inadvertently reveal protected characteristics. You can’t, however, bypass privacy settings or use password‑cracking tools. The Equal Employment Opportunity Commission (EEOC) warns that decisions based on protected characteristics found on social media may trigger discrimination claims.
So, if you see a candidate’s public post about a political rally, tread carefully. A well‑known lawsuit against a retailer in 2021 highlighted the fallout when a hiring manager rejected an applicant after seeing a protest photo on Instagram.
Business Records and Licenses
If a candidate claims a professional license, you can verify it with the issuing board. You may also check business registrations when the role involves vendor management or contractor oversight. These checks are low‑risk and usually free.
But don’t request private corporate documents like profit‑and‑loss statements unless the candidate voluntarily shares them. That overreach can violate candidate privacy rights and the FCRA’s definition of consumer reports.
Permissions Matrix by Data Type
Below is a quick reference that shows who must give consent, when you can collect the data, and the storage limits. Use this table as a checklist before you fire off any background request.
| Data Type | Consent Needed? | When Can You Collect? | Retention Limit |
| Criminal History | Yes (written) | After conditional offer | 24 months |
| Credit Report | Yes (disclosure + authorization) | Before final decision for finance roles | 12 months |
| Social Media (public) | No (publicly available) | Any time during review | Immediate deletion after decision |
| Social Media (private) | No (prohibited) | Never | N/A |
| Professional Licenses | No (verification) | During interview stage | 12 months |
| Employment Verification | Yes (general consent) | Before final offer | 24 months |
Data Handling, Consent, and Retention
Even if the data is lawful to collect, mishandling it can land you in hot water. Let’s walk through the steps to stay compliant.
Obtaining Candidate Consent
Consent isn’t a checkbox you can ignore. Provide a clear, plain‑English disclosure that outlines what you’ll check, why, and how the data will be used. Save the signed form in a secure HRIS folder—preferably encrypted.
And if a candidate refuses, you must decide whether the role is truly dependent on that data. For many non‑financial positions, you can proceed without a credit check, for example.
Storing and Deleting Information
Federal guidelines recommend retaining background records for no longer than two years after a hiring decision. Some states, like New York, require even shorter periods for criminal data.
Now, automate deletion wherever possible. A simple script that purges records after 24 months reduces human error and demonstrates good faith in protecting candidate privacy rights.
FAQ for Recruiters
These are the questions we hear most often on the front lines of talent acquisition.
Can I check a candidate’s Instagram?
If the Instagram account is public, you may view it. However, you cannot use password‑protected content, and you must avoid decisions based on protected classes. A safer route is to stick to professional platforms.
Do I need permission to view LinkedIn?
LinkedIn profiles are public by default, so consent isn’t required. Still, if a candidate has set their profile to private, you must respect that boundary.
What if a candidate disputes a finding?
Under the FCRA, you must provide a copy of the report and a summary of their rights within five business days of the adverse action. Give them a chance to dispute inaccuracies before finalizing the decision.
Are ban‑the‑box rules the same everywhere?
No. While the federal ban‑the‑box pushes conviction questions to after a conditional offer, many states have stricter timelines or outright prohibitions. Always check the state handbook before you ask.
When is a credit check permissible?
Only for positions that involve fiduciary responsibility, access to credit cards, or handling large sums of money. Even then, you need explicit written consent and must follow FCRA disclosure rules.
SmartShield Your Compliance Process
If you’re tired of juggling state variations, consent forms, and data‑retention calendars, you’re not alone. That’s why many forward‑thinking HR teams are turning to SmartHire™ for an integrated hiring platform and to SmartShield.
How Our Tool Helps
Tools like SmartShield™ automate the permissions matrix, flag ban‑the‑box exceptions, and generate FCRA‑compliant consent forms in seconds. It also schedules automatic record deletion based on your retention policy.
And you’ll get real‑time alerts if a state law changes, so you never fall behind. Imagine cutting background check turnaround time by 30% while staying fully compliant—that’s the power of a single platform.
In short, knowing what can recruiters check about candidates is more than a legal checkbox; it’s a strategic advantage. By respecting candidate privacy rights, following recruiter background check rules, and leveraging tools like SmartShield, you’ll make smarter hires, avoid costly penalties, and keep your reputation solid. Stay aware, stay compliant, and let the right data guide you to the right talent.
